What is the CVSS score of CVE-2026-9973?

CVE-2026-9973 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9973?

Google Chrome versions prior to 148.0.7778.216 contain a remote code execution vulnerability in the V8 engine that allows attackers to execute arbitrary code when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-9973?

Within 24 hours: Audit Chrome deployment methods across the organization and confirm availability of Chrome 148.0.7778.216 or later. Within 7 days: Deploy Chrome 148.0.7778.216 or later to all systems via your standard patch channel (auto-update, MDM, group policy, etc.). Within 30 days: Verify patch deployment completion across all endpoints and review security logs for any exploitation indicators.

Google Chrome CVE-2026-9973

EUVD-2026-33115 HIGH

Out-of-bounds Write (CWE-787)

2026-05-28 Chrome

GHSA-xv4h-x4ch-3xmh

Google Memory Corruption RCE Buffer Overflow Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:32 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine prior to 148.0.7778.216 allows attackers to execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. The flaw is an out-of-bounds write (CWE-787) rated High by Chromium and CVSS 8.8, requires user interaction to load attacker-controlled content, and no public exploit has been identified at time of analysis.

Technical ContextAI

V8 is Google's open-source JavaScript and WebAssembly engine that powers Chrome, Chromium-derived browsers, and Node.js. Out-of-bounds write vulnerabilities (CWE-787) in V8 typically arise from flawed bounds checking in JIT-compiled code, optimizing compiler type confusion, or incorrect assumptions in object/array handling, allowing attacker-controlled data to overwrite adjacent heap memory. Per the CPE cpe:2.3:a:google:chrome, all Chrome desktop builds before 148.0.7778.216 ship the vulnerable V8 component; memory corruption in V8 has historically been a reliable primitive for shaping the heap and achieving arbitrary code execution within the renderer process, though Chrome's site-isolation sandbox confines the initial compromise to the renderer until paired with a separate sandbox escape.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.216 or later via the stable channel as announced at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html, then fully relaunch the browser so the new V8 binary is loaded. Enterprises should push the update via Chrome Browser Enterprise / Group Policy and verify chrome://version on managed endpoints, and downstream Chromium browsers (Edge, Brave, Opera, Electron apps) must be updated as their vendors release rebased builds. If immediate patching is not feasible, compensating controls include enabling Chrome's Site Isolation (already default), enforcing strict allowlist-based browsing via SafeBrowsing Enhanced Protection or a web proxy, and disabling JIT for untrusted sites via the JavaScriptJitAllowedForSites/JavaScriptJitBlockedForSites policies (which removes a large class of V8 exploit primitives at the cost of significant JavaScript performance regression on heavy web apps).